Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

do I need to generate a CSR on the load balancer or on the individual servers?

share|improve this question
up vote 4 down vote accepted

You can generate the CSR anywhere. The certificate generated will need to be in a format that the device using it can utilize. Typically, that will be PEM.

share|improve this answer

CSR is a bunch info (like DN, expiration dates, CommonName) in addition to Public Key. Download openssl library and do the tricks mentioned here.

Once ya get the cert, make sure you copy the private key, cert, along with the CA cert (or create a chain cert), since custom applicatins don't often update their root certs.

share|improve this answer

Depends on whether you'll be terminating SSL on the load balancer or web servers...

In general, if your load balancer can handle it, then better to do it all there and take the load off the web servers. Also it allows quicker deployment of new servers as it's one less step to worry about.

Having said that, once you have your private key and ssl cert from the provider, you can back these up and use them wherever you like (on LBs or servers), so you won't be tied to one method or the other permanently.

share|improve this answer
What? They're asking about the certificate request. – Warner May 18 '10 at 13:42
Yes, and I added some relevant thoughts around using load balancers for SSL termination and finished by saying what you did. – Robbo May 18 '10 at 15:59
I didn't down-vote you, I rarely down-vote. CSR != CRT. See: – Warner May 18 '10 at 16:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.